What is the CVSS score of CVE-2026-54753?

CVE-2026-54753 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.8%.

Is there a patch available for CVE-2026-54753?

Yes, a patch is available for CVE-2026-54753. Update the affected software to the latest version immediately.

Nx CVE-2026-54753

EUVD-2026-39831 MEDIUM

Exposed Dangerous Method or Function (CWE-749)

2026-06-26 GitHub_M

GHSA-g2r8-wvmj-jf5w

Information Disclosure Command Injection Red Hat Nx

5.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

vuln.today AI

5.9 MEDIUM

AV:N because attacker JS triggers cross-origin requests over the network; AC:H because nx graph must be actively running; UI:R because the developer must visit the malicious page; C:H for full project graph disclosure; I:L for limited /help injection path.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Red Hat

5.9 MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jun 26, 2026 - 20:02 EUVD

Source Code Evidence Fetched

Jun 26, 2026 - 19:25 vuln.today

Analysis Generated

Jun 26, 2026 - 19:25 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

52 npm packages depend on nx (2 direct, 50 indirect)

Ecosystem-wide dependent count for version 17.0.4.

DescriptionCVE.org

Nx is a monorepo solution for TypeScript and polyglot codebases. From 17.0.4 until 22.7.2 and 23.0.0-beta.2, the local HTTP server started by nx graph sent Access-Control-Allow-Origin: * on every response, letting any website a developer visited read the server's responses cross-origin - including the full project graph and the output of the /help endpoint, which runs a target's configured help command. The practical impact is typically cross-origin information disclosure, but can be arbitrary command injection in rare cases. This vulnerability is fixed in 22.7.2 and 23.0.0-beta.2.

AnalysisAI

Cross-origin information disclosure in the Nx monorepo graph server (versions 17.0.4 through 22.7.1) exposes the full project dependency graph and workspace metadata to any website a developer visits while nx graph is running locally. The server unconditionally broadcasts Access-Control-Allow-Origin: *, bypassing the browser Same-Origin Policy and allowing attacker-controlled JavaScript to silently read internal project structure. In rare cases, the /help endpoint - which executes a workspace-configured target command - creates a path to arbitrary command injection on the developer's machine. No public exploit or CISA KEV listing identified at time of analysis.

Technical ContextAI

Nx's nx graph command launches a local HTTP development server (implemented in packages/nx/src/command-line-graph/graph.ts) that serves an interactive project dependency visualization. Prior to the fix, this server emitted a wildcard CORS header (Access-Control-Allow-Origin: *) on every response. Under the browser Same-Origin Policy, cross-origin reads are blocked by default - this header overrides that protection, permitting any origin's JavaScript to issue fetch() calls to the localhost server and read the response body. The /help endpoint compounds the risk by invoking whatever command a workspace target defines as its help handler. CWE-749 (Exposed Dangerous Method or Function) is accurate: the server exposes an execution endpoint (/help) without origin-scoping, making it reachable from arbitrary third-party websites. The fix confirmed in PR #35494 removes the res.setHeader('Access-Control-Allow-Origin', '*') call entirely.

RemediationAI

Vendor-released patch: 22.7.2 (stable) and 23.0.0-beta.2 (beta). Upgrade by running npm install nx@22.7.2 or yarn add nx@22.7.2 in the workspace. The upstream fix is confirmed in PR #35494 (https://github.com/nrwl/nx/pull/35494), which removes the wildcard CORS header from the graph server. For teams unable to upgrade immediately, avoid running nx graph while browsing untrusted or unknown websites in the same browser session - since exploitation requires both the server to be running and the developer to visit an attacker-controlled page concurrently. Alternatively, use a dedicated browser profile without internet access when running nx graph. No functional side effects are expected from the patch since nx graph is consumed solely by the developer's own localhost browser session.